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Did  you  ever  wonder  ... 


If  the  person  flying  into  your  country  at  a particular  date  every  month  is  visiting 
his  company’s  headquarters? 

\ but  the  date  sometimes  falls  on  a weekend... 

If  the  irregular  high  banking  transaction  of  a certain  person  is  related  to  an 
inheritance  from  his  just  passed  away  mother? 

V or  from  the  art  theft  last  week... 

a 


Sure,  you  are  able  to  answer  these  questions 

But  do  you  have 

- the  time  ? 

- the  staff  to  follow  every  seemingly  unimportant  hint  ? 
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How  do  you  cope  with 


SIEMENS 


...  vague  subscriber  identities 

• Variety  of  pre-paid  SIM  cards  for  mobile  phones 

• Internet  access  from  differing  public  locations 

• Nomadic  use  of  VoIP  phones 

• Variety  of  anonymous  log-in  identities 


...  undetermined  operator  LI  responsibilities 

• Soft  switch  and  payload  via  separate  operators 

• Peer-to-peer  communication 
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Imagine  ... 
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Track  all  major  contact  persons  of  the  main  militant  group  in  the 
country  using  this  data  sources: 

- E-mail,  Fax,  SMS 

- Phone  calls 

- Bank  transfer  data 

- Flight  booking  details 

- Credit  Card  records 

Identify  new  suspicious  persons  and  organisations  regarding  money 
laundering. 

Which  suspect  person  or  group  shows  a different  behaviour  today 
compared  with  the  normal  behaviour? 
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How  can  I find  the 
needle  in  the  haystack? 


...  or  at  least  make  the  haystack  considerably  smaller? 
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The  Intelligence  Platform  in  the  context  of 
Homeland  Security 


Threats  & Challenges 


Missions 
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Intelligence  & 
warnings 


Domestic  counter 
terrorism 

Border  & 

transportation 

security 


• Hijacking 

• Sabotage 

• Nuclear,  Biological, 
Chemical  Agents 


• Natural  Disasters 

• Man-made  Disasters 

• Diseases 
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Critical  infrastructure 
protection 


Defense  against 
catastrophic  events 


Emergency  preparedness 
and  response 
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Customer  Requirements  ... 


Fact 

Law  Enforcement  and  Government  authorities  are  drowning  in  huge  amounts  of 
disparate  data 

Challenge 

To  extract  intelligence  from  this  data  and  produce  usable  information 


Task 

To  provide  a system  that  can  connect  to  all  available  data  sources  to  generate 
comprehensive  profiles  of  persons,  groups,  or  entities 

in  TIME 
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The  Intelligence  Platform 
Design  principle 


The  Siemens  Intelligence  Platform  is  designed  for  organisations  related  to 

• Law  Enforcement 

• Government 

• Other  investigative  organisations 


support  their  task  in  the  fields  of 

Intelligent  Analysis 

• Case  Management 

• Forensics 
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Market  Positioning 

• Main  goal:  Creating  new  intelligence 

• User:  Intelligence  Officers  and  Analysts 

• Customising  and  service  are  substantial  parts  of  the  offer 

• Parallel  product  line  to  the  Siemens  Monitoring  Center 
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Your  Solution  - 
The  Intelligence  Platform 

• Integrate  data  from  many  different  sources 

• Structure  unstructured  data  (files)  by  deploying  Indexing  and 
Intelligence  Modules 

• Create  new  intelligence  using  sophisticated  Intelligence  Applications 

• Processing  of  mass  data  to  enable  comprehensive  investigations 

• Object  oriented  handling  (e.g.  targets,  cases) 

• One  desktop  for  all  applications 
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Intelligence  Platform 
System  Architecture 
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Intelligence  Warehouse 


Data  Integration 


Customer  Data  Sources  and  MC 


enrich  the 
collected 
unstructured 
information 
with  new 
meta  data 


Connect  to 
data 

sources  and 
gather  data 

Any 

customer 
accessible 
data  source 
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Data  Integration 
Examples  of  Data  Sources 

• Siemens  Monitoring  Center 

• Data  Retention  Systems 

• Telephone  book  data  bases 

• Telephone  billing  records 

• Internet  Protocol  Address  GIS 

• Police  and  criminal  records 

• Driving  Licence  register 

• Traffic  control  points 

• Vehicle  registration  data  base 

• Credit  card  transactions 
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• Bank  account  transactions 

• Insurance  company  data  bases 

• Border  Control  data  base 

• Passport  data  base 

• Finger  print  data  base 

• DNA  analysis  data  base 

• Registry  office  records 

• Land  registry  data  base 

• Car  rental  data  base 

• Any  other  data  base  which 
contain  relevant  data 
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Intelligence  Warehouse 


• The  Intelligence  Warehouse  stores  all  collected  operational  data 

- Database 

- File  Storage  System 

• Data  can  be  entered  in  different  ways 

- Imported  by  Data  Integration 

- Created  by  Intelligence  Applications  or  Intelligence  Modules 

- Manually  entered  by  the  Analyst 

• Data  stored  can  be  accessed,  processed,  and  viewed  from  the 
Intelligence  Desk 
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draw  new 
intelligence 
based  on 
enriched 
meta  data 


Goal:  Create  new  Intelligence 
from  existing  information 


Intelligence  Desk 
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Intelligence  Applications 
Overview 


• Intelligence  Mining 

- Pattern  Recognition 

- Pattern  Profiling 

- Link  Analysis 

• Rule  Based  Queries 

• Indexing 

- Full  Text  Indexing  and  Retrieval 

- Named  Entity  Extraction 
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Intelligence  Applications 
Intelligence  Mining:  Pattern  Recognition 


• Detects  automatically  all  reoccurring  patterns  meeting  certain  criteria 


How  does  it  work? 

• Define  the  objects  and  links  (relations) 

• Set 

- time  frame  in  which  patterns  occur 

- minimum  occurrence  count 

• Data  Source:  Intelligence  Warehouse 
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Intelligence  Applications 

Intelligence  Mining:  Pattern  Recognition  - Example 
Example  Task: 

• Search  for  suspicious  patterns  in 
21,237,645  call  records 

Criteria: 

• Time  frame:  1 hour 

• Minimum  count:  5 


Additional  Examples 

• money  transfers  between  bank  accounts 

• geographical  movements  of  targets 
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Intelligence  Applications 
Intelligence  Mining:  Pattern  Profiling 


Principle: 

• Pattern  Profiling  includes  patterns  with 

- behavior 

- communication 

- movement 

- relationship 

• A target  usually  has  its  individual  behavior  which  only  changes  slowly 
over  time 


• Sudden  changes  in  target  behavior 

- Generates  an  alarm 

- Draws  the  analyst’s  attention 
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Intelligence  Applications 

Intelligence  Mining:  Pattern  Profiling  - Example 
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Intelligence  Applications 
Intelligence  Mining:  Link  Analysis 


• The  nodes  represent  any  kind  of  object  available  in  the  database 


The  links  represent  relations  between  these  objects 


Display  the  relation  of 
any  information 
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Intelligence  Applications 
Rule  Based  Queries 


• To  construct  complex  database  queries  without  database  knowledge 

• The  analyst  constructs  a semi-graphical  model  of  the  query 

• The  system  retrieves  all  instances  from  the  database  that  fulfil  the  Rule 


Example: 

Search  the  database  for  all 
occurrences  where  two  suspects 

a)  are  communicating  via  phone  calls 

b)  use  a bank  account  to  transfer 
money  via  a third  party 
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Intelligence  Applications 
Indexing:  Full  Text  Indexing  and  Retrieval 

• Indexing  is  performed  on  all  sorts  of  text  documents,  like 

- Web  pages 

- Word  documents,  Transcripts 

- Emails,  SMS,  Chat  protocols 
as  well  as  on  data  base  records  in  general 

• The  Indexing  process  constantly  runs  in  the  background 

• The  analyst  can  quickly  search  in  a Google-like  manner  for  words  or  phrases 

• Typical  response  time  < 1 sec 
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Intelligence  Applications 

Indexing:  Named  Entity  Extraction  - Example 


Task:  Find  targets  sharing  a name  of  a geographical  place 
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Intelligence  Modules 
Overview 


Voice  Domain 

Speaker  Recognition 
Language  Recognition 
Word  & Phrase  spotting 
Topic  Spotting 
Emotion  detection 

4*!  t>e)c/[/&e')ce 

• Automatic  Transcription 

Text  Domain 

• Topic  Spotting 

• 

Language  Detection 

• 

Optical  Character  Recognition 

• 

Automatic  Translation 

Image  Domain 

• 

Image  Recognition  (Images/Pictures/Logotypes) 

• 

Video  Recognition 
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Intelligence  Modules 

Topic  Spotting  in  the  text  domain 


How  does  it  work? 

• The  Analyst  defines  a number  of  topics,  e.g.: 

- Drug  Trafficking 

- Corruption 

- Money  Laundering 

- Kidnapping 

• The  analyst  provides  sample  documents  containing  typical 
contents  for  each  topic 

• The  Intelligence  Module  is  trained  on  the  samples 

• After  training  the  Intelligence  Module  classifies  documents 
with  unknown  contents  according  to  the  trained  classes 

• Topic  Spotting  is  language  independent 
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Intelligence  Modules 
Topic  Spotting  - Text  example 
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Typical  Topic  Spotting  result  (accuracy  ~90%) 
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Intelligence  Modules 

Language  Detection  - Text  example 


Topic  Spotting  applied  to  language  detection  (accuracy  = 100%) 
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Intelligence  Modules 
Process  Management 


Task:  Process  an  input  file  with  a number  of  different  Intelligence 
Modules  according  to  a user  defined  workflow 

Default  processes 


• Analysts  can  graphically  design  processes  on  their  own 


Goal:  To  enable  automated  analysis  processes 
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Intelligence  Modules 
Process  Management  - Example 
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Intelligence  Desk 
Overview 


• Common  workplace  for  the  analyst  to  support 

- Planning  and  Direction 

- Analysis  and  Production 

- Dissemination 

within  the  Intelligence  Cycle 


• Integration  of  the  different  Intelligence  Applications  and  Modules 

- Configuration 

• Visualisation 


• Customer  and  investigation  specific  reporting 
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Intelligence  Desk 
Concept 


• The  Intelligence  Platform  is  based  on  an  object  oriented  concept 

Object  types  - examples: 

- Target 

- Telephone  number 

- Car  licence  number 

- Bank  account  number 

- Civic  registration  number 

- Date  and  Time 

• In  each  object  the  user  can  drill  down  to  get  the  properties  of  the  object,  e.g. 

- Target 

- Telephone  number,  email  address 

- Associated  objects 
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Intelligence  Desk 
Views  & Roles 


Views 


• Structured  View,  similar  to  Windows  Explorer 

• Object  View 

- Targets 

- Attributes 

- Communications 

• Analysis  View 

- Intelligence  Applications 

- Intelligence  Modules 

- Process  Management 


Roles  & Security 

• Analyst,  Investigator  (restricted  access) 

• Supervisor  (defined  access) 

• Administrator  (contents  not  accessible) 
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Intelligence  Desk 

Object  Views  - Target  centric 
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Intelligence  Desk 

Object  Views  - Email  centric 
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Intelligence  Desk 
Location  Tracking  - GIS 
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Geographical  view  is  applicable  to  any  objects  for  which  location  information 
is  available,  e.g. 


• Vehicle  tracking  using 
Toll  Road  Systems 

• Location  information  of 
ATM  machines 

• Mobile  phone  tracking 

• Geographical  IP  address 
mapping  of  nomadic  targets 

• Information  provided  by 
surveillance  teams 
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Intelligence  Desk 
Workflow  Management 

The  Workflow  Management  supports  the  customer  to  comply  with 
standardised  procedures: 

• The  customer’s  operational  processes  are  reflected  within  this  system 

• Collaboration  functions  enable  efficient  teamwork 

• National  and  legal  restrictions  can  be  depicted  within  the  Workflow 
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Intelligence  Desk 
Reporting  - Dissemination 


Comprehensive  reporting  function 

• Based  on  templates 

• Templates  are  customised  depending  on  specific  requirements 

• Mixed  content:  Charts,  tables,  plain  text,  structured  text 

• Various  output  formats,  e.g.  Word,  Acrobat  Reader,  Excel 
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Statistics 

The  Intelligence  Platform  constantly  maintains  different  kinds  of 
statistics.  These  include 

• Workload  of  the  Intelligence  Applications  and  Modules 

• Workload  of  database  and  data  storage 

• Health  information  of  the  Intelligence  Applications  and  Modules 

• Operator  statistics  per  role,  user,  tool  usage  etc. 
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System  Aspects 
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] Challenges 
} Requirements 

] Intelligence  Tools 


] System  Aspects 


] Summary 


Intelligence  Platform 
Architecture 


Scalability: 

The  system  can  operate  as  a 

- “Mini-Sized”  entry  system  as  well  as  with 

- Data  Center  dimensions  processing  mass  data  (TB) 

Redundancy: 

Avoid  single  points  of  failure 

Dislocation: 

Remote  access  possible 

Modularity: 

Basic  Platform  System  - with  optional  extensions 
Intelligence  Modules 
Intelligence  Applications 
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Modularity 


Basic  System 

• Intelligence  Warehouse 

• Data  Integration 

• Intelligence  Desk 

• Basic  set  of  Intelligence  Applications 

• Basic  set  of  Intelligence  Modules 


Optional  components 

• Additional  Intelligence  Applications 

• Additional  Intelligence  Modules 

• Workflow  Management 
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Customisation 


• End-to-end  solution  provided  by  Siemens 

• High  customisation  level  of 

- Interfaces 

- Templates  (e.g.  Reports) 

- Workflow 

• Service  agreements  for 

- Regular  upgrades 

- Integration  of  Customer  Data  Sources 

- Template  modifications 
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] Challenges 
] Requirements 

] Intelligence  Tools 


] System  Aspects 


) Summary 


Intelligence  Platform 
Advantages 


Operational 

• 

Reduced  manpower,  reduced  operating  costs 

• 

Harmonise  Homeland  Security  information 

• 

Instant  customized  reports,  e.g.  “Daily  Status” 

Process 

• 

Automated  supervision  of  target  behaviour 

• 

Don’t  miss  any  part  of  information,  e.g.  Dragnet  Investigations 

Analysis 

• 

Comprehensive  identification  of  former  unknown  suspects 

• 

Very  fast  results 
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Fact  & Objective 
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Thank  you  for  your  attention 


Name:  Tilmann  L.  Gabriel 

E-mail:  tilmann-laurence.gabriel.ext@siemens.com 
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